CVE-2024-7767

Name of the Vulnerable Software and Affected Versions danswer-ai/danswer version v0.3.94

Description An improper access control issue exists, allowing the first user created in the system to view, modify, and delete chats created by an Admin. This can lead to unauthorized access to sensitive information, loss of data integrity, and potential compliance violations.

Recommendations For version v0.3.94, consider restricting the privileges of the first user created in the system to prevent unauthorized access to sensitive information until a patch is available. As a temporary workaround, restrict access to chats created by an Admin to minimize the risk of exploitation.